How to Block Apple’s iCloud Private Relay Using Pi-hole and DNS Filtering

Apple’s iCloud Private Relay is a privacy feature available to iCloud+ subscribers that helps prevent websites and network providers from tracking a user’s browsing activity in Safari. While this provides an additional layer of privacy for end users, it can present challenges for organisations, schools, managed networks, and even some home users who rely on DNS filtering and content controls.

If you’re using Pi-hole, AdGuard Home, NextDNS, Technitium DNS, or another DNS filtering solution, you may have noticed that Apple’s Private Relay allows Safari traffic to bypass many of the protections you’ve carefully put in place.

Fortunately, Apple has provided a mechanism that allows network administrators to signal that Private Relay should be disabled on their network. This is achieved by blocking access to Apple’s mask (or “iMask”) domains.

This guide explains how it works and how to configure Pi-hole and other DNS servers to disable Private Relay.

What is Apple Private Relay?

Private Relay works in a similar way to a VPN, although it isn’t designed to replace one.

When enabled:

• Safari traffic is encrypted.
• DNS requests are hidden from the local network.
• Your ISP cannot see which websites you’re visiting.
• Websites only see an anonymised IP address rather than your real public IP.

Unlike a traditional VPN, Private Relay uses two separate internet relays. Apple knows who you are but not where you’re browsing, while the second relay knows where you’re browsing but not who you are. This split design significantly improves user privacy.

However, this also means:

• Pi-hole cannot inspect or filter Safari DNS requests.
• Local parental controls may be bypassed.
• Website logging becomes less accurate.
• Geo-location filtering may not work as expected.
• DNS-based malware protection can be circumvented.

Why Would You Want to Disable It?

There are several legitimate reasons.

Home Networks

Many households use Pi-hole to:

• block adverts
• prevent malware
• filter inappropriate websites
• monitor DNS activity
• improve browsing performance

If one family member enables Private Relay, only their Safari traffic bypasses these protections.

Business Networks

Many UK businesses rely on DNS filtering for:

• Cyber Essentials compliance
• Acceptable Use Policies
• Web content filtering
• Threat protection
• Network monitoring

Private Relay can reduce the effectiveness of these security controls.

Schools and Colleges

Educational establishments often use DNS filtering to comply with safeguarding requirements.

Allowing Private Relay could enable students to bypass internet filtering, which is why many education providers disable it on managed networks.

Apple’s Recommended Method

Apple does not recommend attempting to block every Private Relay server.

Instead, they provide a supported mechanism.

When an Apple device cannot resolve certain “mask” domains, it assumes the network administrator does not permit Private Relay and automatically disables the feature while connected to that network.

This is simple, reliable and survives infrastructure changes made by Apple.

The Domains to Block

The most important domains are:

mask.icloud.com
mask-h2.icloud.com

Some administrators also choose to block:

mask-api.icloud.com

Blocking these domains causes Apple devices to display:

Private Relay is unavailable on this network.

The feature automatically re-enables once the device leaves your network.

Configuring Pi-hole

Adding these domains to Pi-hole only takes a minute.

Open the Pi-hole web interface.

Navigate to:

Domains → Deny

Add:

mask.icloud.com
mask-h2.icloud.com
mask-api.icloud.com

Select:

Exact Match

Save the entries.

Once DNS caches expire, Apple devices connected to your network will disable Private Relay.

Using the Pi-hole Command Line

You can also add them directly from the terminal:

sudo pihole --regex '^mask\.icloud\.com$'
sudo pihole --regex '^mask-h2\.icloud\.com$'
sudo pihole --regex '^mask-api\.icloud\.com$'

Alternatively, use exact domain blocking if preferred.

AdGuard Home

For AdGuard Home users:

Navigate to:

Filters → DNS Blocklists

or

Custom Filtering Rules

Add:

||mask.icloud.com^
||mask-h2.icloud.com^
||mask-api.icloud.com^

Save the configuration.

Technitium DNS Server

In Technitium DNS:

Create a custom blocking zone.

Add the following records:

mask.icloud.com
mask-h2.icloud.com
mask-api.icloud.com

Configure them to return:

NXDOMAIN

or

0.0.0.0

Either method prevents Apple devices from contacting the Private Relay service.

Microsoft DNS

Windows Server administrators can also block the domains.

Create a Forward Lookup Zone named:

mask.icloud.com

Repeat for the remaining domains.

Create an empty zone or return a non-routable address.

Because your DNS server now claims authority for the zone, clients can no longer resolve Apple’s relay service.

BIND DNS

For Linux administrators using BIND:

Create a master zone:

zone "mask.icloud.com" {
    type master;
    file "/etc/bind/db.block";
};

Repeat for the other domains.

The zone can simply return NXDOMAIN.

pfSense and OPNsense

If you’re using pfSense or OPNsense with either:

• Unbound DNS
• DNS Resolver
• DNS Forwarder

Add local-zone overrides for:

mask.icloud.com
mask-h2.icloud.com
mask-api.icloud.com

Configure them to return NXDOMAIN.

How to Verify It Works

After applying the DNS changes:

On an iPhone or iPad:

Settings

→ Apple Account

→ iCloud

→ Private Relay

You should see a message stating:

Private Relay is unavailable because your network does not allow it.

You can also test from a computer:

nslookup mask.icloud.com

The lookup should fail or return your blocking address.

Does This Affect Other Apple Services?

No.

Blocking only the mask domains does not affect:

• App Store
• FaceTime
• iMessage
• Apple Music
• Apple TV
• iCloud Drive
• Photos
• Find My
• Software Updates

Only the Private Relay feature is disabled while connected to your network.

Can Users Bypass This?

Potentially.

Users could still:

• use a third-party VPN
• change their DNS server (if your router allows it)
• use mobile data instead of Wi-Fi

For business or educational environments, it’s recommended to combine DNS filtering with:

• firewall rules
• forced DNS
• device management (MDM)
• web proxy policies
• endpoint security software

Is This Supported by Apple?

Yes.

Apple explicitly documents this behaviour for enterprise and managed networks. Rather than trying to block hundreds of changing relay servers, Apple recommends preventing access to the designated mask domains. When these domains cannot be resolved, compatible Apple devices automatically disable Private Relay on that network.

This approach is more reliable, easier to maintain, and far less likely to break with future iCloud infrastructure changes.

Final Thoughts

Apple’s Private Relay is an excellent privacy feature for many users, particularly when browsing on public Wi-Fi or untrusted networks. However, on managed home, business, and educational networks, it can interfere with legitimate DNS filtering, parental controls, and security monitoring.

Fortunately, Apple has provided a straightforward and officially supported method to disable Private Relay on networks where it is not appropriate. By blocking just a handful of mask domains within Pi-hole or your preferred DNS server, you can ensure that Safari traffic once again follows your existing DNS filtering policies.

For most administrators, this solution takes less than five minutes to implement and requires virtually no ongoing maintenance. Whether you’re protecting a family network, maintaining compliance for a small business, or managing internet access in a school, blocking Apple’s mask domains is currently the simplest and most effective way to prevent Private Relay from bypassing your DNS security.